Home / Knowledge hub / Deny by default
Knowledge hub
Deny by default
Refusing every request unless a rule explicitly allows it.
What it means
Deny by default is a design rule: access is refused unless a rule says it is allowed. A new page, a new endpoint, a new role or a new network port starts closed, and someone has to make a deliberate choice to open it.
The opposite is allow by default, where everything is open until someone remembers to block it. The difference shows up when a rule is forgotten, which will happen sooner or later. Safe systems start closed and are opened on purpose.
Why it matters
Forgetting is the common failure. With deny by default, a forgotten rule means a feature that does not work yet, which someone reports and fixes. With allow by default, it means a feature that works for everyone, including people who should not see it. That is a classic route to broken access control.
OWASP lists it among its core principles for access control, and it is the same idea behind sound firewall rules. It also makes reviews easier: you read a list of what is allowed, instead of searching for everything that was not blocked.
How it shows up
You meet it in route and endpoint permissions, cloud policies, firewall rules and framework settings. In a web app it means a new endpoint requires sign-in and a permission check unless it is explicitly marked public. Use an allowlist, not a list of banned things.
Test it by adding something new and seeing what is exposed. Look for routes that were never given a permission rule, background or admin endpoints added late, and missing cases such as an unknown role or empty value being treated as allowed. A permission check that fails open on error undoes the principle, see server-side authorisation.
Questions people ask
Deny by default, answered
Is deny by default the same as least privilege?
Related, not identical. Least privilege limits how much access each account gets. Deny by default decides what happens when no rule applies: the answer is no.
Does it apply to firewalls and networks too?
Yes. A firewall that drops all traffic except what is explicitly permitted follows the same rule. Only the needed ports and sources are opened. Only the ports, sources and destinations you need are opened, and the rest is refused.
What does fail closed mean?
If a permission check cannot be completed, because of an error or a missing value, the request is refused instead of allowed. It is deny by default applied to failures.
How do frameworks help?
Many let you require authentication and authorisation for all routes globally and opt out on the few public ones. That setting is worth switching on early.
How do we test it?
Look for endpoints with no permission rule, call them without signing in and from an account with no rights, and check that unknown roles and empty values are refused.
Sources
Where this comes from
Related
Terms that sit next to this one
Least privilege
Giving every person and service the minimum access the job requires.
Allowlist
A list of what you permit, with everything else refused by default.
Broken access control
An application failing to enforce its own rules about who may do what.
Server-side authorisation
Enforcing permissions on the server, because hiding a button in the page protects nothing.
Secure defaults
Settings that are safe out of the box, so no one has to remember to turn them on.
What opens when someone forgets?
Forgotten permission rules are found by testing the running app, and in white-box mode a finding can point to the route and line that lacks the check. Each finding carries the request and response. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.